Vulnerability Weakness Types
Browse CVEs by CWE classification. Click a CWE to see all associated vulnerabilities.
CWE-284 (2639)
CWE-79 (1895)
CWE-416 (1379)
CWE-862 (1223)
CWE-89 (1114)
CWE-22 (1034)
CWE-125 (931)
CWE-306 (859)
CWE-200 (856)
CWE-122 (832)
CWE-20 (802)
CWE-787 (729)
CWE-78 (723)
CWE-918 (699)
CWE-863 (659)
CWE-94 (649)
CWE-74 (604)
CWE-639 (570)
CWE-400 (535)
CWE-269 (506)
CWE-119 (504)
CWE-502 (478)
CWE-770 (449)
CWE-287 (443)
CWE-121 (410)
CWE-190 (380)
CWE-77 (375)
CWE-362 (374)
CWE-476 (305)
CWE-352 (288)
| CVE | Severity | CVSS | EPSS | Published | Description | Flags |
|---|---|---|---|---|---|---|
CVE-2026-42129 |
high | 7.7 | 0.0044 | 2026-06-22 | A user with Viewer permissions can use a path traversal in the Loki data source plugin to reach admi | |
CVE-2026-55488 |
high | 7.7 | 0.0060 | 2026-06-24 | motionEye (mEye) is an online interface for a piece of software called "motion," which is a video su | |
CVE-2026-56054 |
high | 7.7 | 0.0047 | 2026-06-25 | Subscriber Arbitrary File Deletion in JS Help Desk <= 3.1.1 versions. | |
CVE-2026-45807 |
high | 7.7 | 0.0057 | 2026-06-26 | Kestra is an open-source, event-driven orchestration platform. Prior to 1.0.43 and 1.3.19, several K | |
CVE-2026-55607 |
high | 7.7 | 0.0069 | 2026-06-29 | Claude Code is an agentic coding tool. From 2.1.38 until 2.1.163, Claude Code's worktree handling a | |
CVE-2026-14468 |
high | 7.7 | 0.0044 | 2026-07-06 | HashiCorp Terraform Enterprise contained an issue in its version control system (VCS) ingestion of r | |
CVE-2026-59832 |
high | 7.7 | 0.0046 | 2026-07-09 | SiYuan is an open-source personal knowledge management system. Prior to 3.7.1, the /snippets/*filepa | |
CVE-2026-15392 |
high | 7.7 | 0.0020 | 2026-07-14 | DBD::File versions before 1.651 for Perl do not ensure the table file is not a symlink to an untrust | |
CVE-2026-62229 |
high | 7.7 | 0.0072 | 2026-07-17 | OpenClaw before 2026.5.18 contain an authorization bypass vulnerability in exec allowlist glob match | |
CVE-2026-54910 |
high | 7.7 | 0.0038 | 2026-07-20 | FileBrowser Quantum is a free, self-hosted, web-based file manager. Prior to version 1.4.3-beta, the | |
CVE-2026-59542 |
high | 7.7 | 0.0047 | 2026-07-23 | Subscriber Arbitrary File Deletion in Kali Forms <= 2.4.18 versions. | |
CVE-2026-8183 |
high | 7.7 | 0.0056 | 2026-08-05 | IBM Langflow OSS 1.0.0 through 1.10.3, 1.0.0 through 1.10.3, 1.0.0 through 1.10.3, 1.0.0 through 1.1 | |
CVE-2026-73498 |
high | 7.7 | 0.0048 | 2026-08-12 | MCP Atlassian is a Model Context Protocol (MCP) server for Atlassian products (Confluence and Jira). | |
CVE-2026-65582 |
high | 7.7 | 0.0044 | 2026-08-13 | Subscriber Arbitrary File Download in AI Hub <= 1.3.10 versions. | |
CVE-2026-105945 |
high | 7.7 | 0.0049 | 2026-10-21 | The Pulsar Packages Management Service can be configured to store packages on the local filesystem o | |
CVE-2026-84294 |
high | 7.7 | 0.0035 | 2026-10-29 | Improper limitation of pathname in the Ad Hoc Transfer component of Progress Software WS_FTP Server | |
CVE-2026-106634 |
high | 7.7 | 0.0046 | 2026-10-13 | Adobe Experience Manager is affected by an Improper Limitation of a Pathname to a Restricted Directo | |
CVE-2023-29104 |
high | 7.6 | 0.0071 | 2023-05-09 | A vulnerability has been identified in SIMATIC Cloud Connect 7 CC712 (All versions >= V2.0 < V2.1), | |
CVE-2026-41419 |
high | 7.6 | 0.0031 | 2026-04-24 | 4ga Boards is a boards system for realtime project management. Prior to 3.3.5, a path traversal vuln | |
CVE-2026-49290 |
high | 7.6 | 0.0083 | 2026-06-19 | Slopsmith is a self-contained web application for browsing, playing, and practicing Rocksmith 2014 C | |
CVE-2026-65695 |
high | 7.6 | 0.0048 | 2026-07-23 | Office-Word-MCP-Server through 1.1.11 contains a path traversal vulnerability in its document tools | |
CVE-2026-44763 |
high | 7.6 | 0.0040 | 2026-08-11 | SAP Manufacturing Integration and Intelligence allows a privileged attacker to exploit insufficient | |
CVE-2024-25183 |
high | 7.5 | 0.0073 | 2025-12-29 | givanz VvvebJs 1.7.2 is vulnerable to Directory Traversal via scan.php. | |
CVE-2026-46343 |
high | 7.5 | 0.0042 | 2026-08-19 | Wazuh is a free and open source platform used for threat prevention, detection, and response. From 4 | |
CVE-2026-28167 |
high | 7.5 | 0.0050 | 2026-08-24 | Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability in WebR | |
CVE-2026-116690 |
high | 7.5 | 0.0056 | 2026-10-27 | MLflow is an open source AI engineering platform for agents, large language models, and machine lear | |
CVE-2026-57200 |
high | 7.5 | 0.0088 | 2026-10-27 | Asterisk is an open source private branch exchange and telephony toolkit. Prior to Asterisk 20.20.1, | |
CVE-2026-15323 |
high | 7.5 | 0.0086 | 2026-10-28 | The Product Designer for WooCommerce WordPress | Lumise plugin for WordPress is vulnerable to Direct | |
CVE-2022-47762 |
high | 7.5 | 0.0093 | 2023-02-03 | In gin-vue-admin < 2.5.5, the download module has a Path Traversal vulnerability. | |
CVE-2026-0669 |
high | 7.5 | 0.0044 | 2026-01-07 | Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability in Wiki | |
CVE-2026-35485 |
high | 7.5 | 0.0068 | 2026-04-07 | text-generation-webui is an open-source web interface for running Large Language Models. Prior to 4. | |
CVE-2026-41180 |
high | 7.5 | 0.0039 | 2026-04-23 | PsiTransfer is an open source, self-hosted file sharing solution. Prior to version 2.4.3, the upload | |
CVE-2026-42520 |
high | 7.5 | 0.0041 | 2026-04-29 | Jenkins Credentials Binding Plugin 719.v80e905ef14eb_ and earlier does not sanitize file names for f | |
CVE-2025-65418 |
high | 7.5 | 0.0064 | 2026-05-11 | docuFORM Managed Print Service Client 11.11c is vulnerable to a directory traversal allowing attacke | |
CVE-2026-3366 |
high | 7.5 | 0.0060 | 2026-05-27 | IBM InfoSphere Optim Test Data Fabrication 1.0.0, 1.0.0.1, 1.0.0.2, 1.0.2, 1.0.2.2, 1.0.2.3, 1.0.2.4 | |
CVE-2026-44635 |
high | 7.5 | 0.0036 | 2026-05-27 | Kysely is a type-safe TypeScript SQL query builder. From 0.26.0 to 0.28.16, DefaultQueryCompiler.vis | |
CVE-2026-44594 |
high | 7.5 | 0.0039 | 2026-05-28 | esm.sh is a no-build content delivery network (CDN) for web development. In 137 and earlier, a Local | |
CVE-2026-49061 |
high | 7.5 | 0.0036 | 2026-06-15 | Unauthenticated Arbitrary File Download in WPC Product Options for WooCommerce <= 3.2.1 versions. | |
CVE-2026-22334 |
high | 7.5 | 0.0047 | 2026-06-17 | Subscriber Arbitrary File Download in Woocommerce Book Price <= 1.3 versions. | |
CVE-2026-9690 |
high | 7.5 | 0.0033 | 2026-06-17 | Unauthenticated Arbitrary File Download in WP Media folder Addon <= 4.0.1 versions. | |
CVE-2026-52844 |
high | 7.5 | 0.0062 | 2026-06-23 | Caddy is an extensible server platform that uses TLS by default. Prior to 2.11.4, on Windows, Caddy | |
CVE-2026-54066 |
high | 7.5 | 0.0217 | 2026-06-24 | SiYuan is an open-source personal knowledge management system. Prior to 3.7.0, the patch for CVE-202 | |
CVE-2026-9776 |
high | 7.5 | 0.0185 | 2026-06-24 | ATEN Unizon writeFileToHttpServletResponse Directory Traversal Information Disclosure Vulnerability. | |
CVE-2026-57872 |
high | 7.5 | 0.0145 | 2026-06-26 | An unauthenticated directory traversal vulnerability exists in get_fcont.cgi in GeoVision GV-LPC2011 | |
CVE-2026-55677 |
high | 7.5 | 0.0052 | 2026-06-26 | Echo is a Go web framework. Prior to 4.15.3 and 5.2.0, Echo's router and static file handler disagre | |
CVE-2026-8023 |
high | 7.5 | 0.0087 | 2026-06-29 | Zephyr's HTTP server (subsys/net/lib/http) provides a static-filesystem resource type (HTTP_RESOURCE | |
CVE-2026-58015 |
high | 7.5 | 0.0084 | 2026-06-30 | A flaw was found in GLib. The D-Bus client-side implementation of the DBUS_COOKIE_SHA1 SASL authenti | |
CVE-2026-11595 |
high | 7.5 | 0.0078 | 2026-06-30 | IBM WebSphere Application Server 9.0, and 8.5 could allow a remote attacker to obtain sensitive info | |
CVE-2026-20191 |
high | 7.5 | 0.0065 | 2026-07-01 | A vulnerability in Cisco Catalyst Center could allow an unauthenticated, remote attacker to read arb | |
CVE-2026-13369 |
high | 7.5 | 0.0060 | 2026-07-02 | The Ninja Forms - File Uploads plugin for WordPress is vulnerable to Arbitrary File Read via the att |